activecm/docker-zeek

Stars
44
Rank 634,578 (Top 13 %)
Language
Shell
License
MIT License
Created over 4 years ago
Updated 3 months ago

activecm/docker-zeek

activecm

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Run zeek with zeekctl in docker

rita-legacy

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

BeaKer

Beacon Kibana Executable Report. Aggregates Sysmon Network Events With Elasticsearch and Kibana

passer

Passive service locator, a python sniffer that identifies servers, clients, names and much more

threat-tools

Tools for simulating threats

rita

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

threat-hunting-labs

Collection of walkthroughs on various threat hunting techniques

espy

Endpoint detection for remote hosts for consumption by RITA and Elasticsearch

smudge

Passive OS detection based on SYN packets without Transmitting any Data

pcap-stats

Learn about a network from a pcap file or reading from an interface

bro-install

An Installation Script for Bro IDS on Debian Based Systems

zcutter

Extracts fields from zeek logs, compatible with zeek-cut

devprof

Device profile: Define acceptable amounts of traffic for your devices and see a report of outliers.

sniffer-template

Template for building a packet sniffer

zeek-open-connections

ipfix-rita

Collect IPFIX / Netflow v9 Records and Ship them to RITA for Analysis

rita-bl

Real Intelligence Threat Analytics -- Blacklist Database

mongo-diff

A Python script for diff'ing mongo databases

zeekcfg

A node.cfg generator for zeekctl

zeek-log-transport

This script ships logs from Zeek to AC-Hunter

pi_show

Python script/library for displaying text and graphics on Raspberry Pi PiOled Hat

shell-lib

Shell Scripts Used Across ActiveCM Projects

certificate-issues

Identifies certificate problems from Zeek ssl log files

pi_project_installer

A support library and set of scripts to simplify installing software on the Raspberry Pi/Raspbian

rita-blacklist

Real Intelligence Threat Analytics -- Blacklist Database

mgosec

A Small Helper Library For Securing MongoDB Connections with Golang

bro-rita

A bro plugin for writing log data to MongoDB for use with RITA

safelist-tools

Tools for working with the safelist (formerly whitelist)

docker-ca

A Docker Image For OpenSSL Certificate Authorities (For Testing)

pcap-resources

Support files and tools for pcap analysis and packet capture

zeek-log-clean

Delete Zeek log files until disk usage is under a given threshold

save_json_stream

JSON TCP stream importer for RITA and AC-Hunter

DBTest

Managed Integration Testing Dependencies via Docker for Go

bro-rita-test

Compares bro-rita against rita's built in parsing

bro-mongodb